UniFi Site Manager: Firmware Update Available

Status: available
Severity: low
Time window: 1d
Group by: Id
Source: github.com/Azure/Azure-Sentinel

Identifies UniFi devices with firmware updates available. Keeping firmware patched is critical as updates often include security vulnerability fixes.

MITRE ATT&CK coverage

Tactic	Techniques
Initial Access	`T1190` Exploit Public-Facing Application

Rule body

id: 83b88ab5-21ca-5dd2-df91-6db4354f9360
name: "UniFi Site Manager: Firmware Update Available"
description: |
  Identifies UniFi devices with firmware updates available. Keeping firmware patched is critical as updates often include security vulnerability fixes.
severity: Low
status: Available
requiredDataConnectors:
  - connectorId: UniFiSiteManagerConnectorDefinition
    dataTypes:
      - Unifi_SiteManager_Devices_CL
queryFrequency: 1d
queryPeriod: 1d
triggerOperator: gt
triggerThreshold: 0
tactics:
  - InitialAccess
relevantTechniques:
  - T1190
subTechniques: []
query: |
  Unifi_SiteManager_Devices_CL
  | where TimeGenerated > ago(1d)
  | summarize arg_max(TimeGenerated, *) by Id
  | where isnotempty(UpdateAvailable)
  | extend DeviceDetail = strcat(coalesce(Name, "Unnamed"), " (", Model, ") ", Version, " -> ", UpdateAvailable, " @", Ip)
  | summarize
      DevicesNeedingUpdate = count(),
      DeviceList = make_list(DeviceDetail),
      Models = make_set(Model),
      ProductLines = make_set(ProductLine)
  | where DevicesNeedingUpdate >= 1
  | extend
      TimeGenerated = now(),
      AffectedModels = strcat_array(Models, ", "),
      AffectedProductLines = strcat_array(ProductLines, ", "),
      DeviceListString = strcat_array(DeviceList, "; ")
  | extend Activity = strcat(DevicesNeedingUpdate, ' device(s) have firmware updates available: ', AffectedModels)
  | project
      TimeGenerated,
      DevicesNeedingUpdate,
      AffectedModels,
      AffectedProductLines,
      Activity,
      DeviceListString
entityMappings:
  - entityType: CloudApplication
    fieldMappings:
      - identifier: Name
        columnName: AffectedProductLines
incidentConfiguration:
  createIncident: true
  groupingConfiguration:
    enabled: true
    reopenClosedIncident: false
    lookbackDuration: P7D
    matchingMethod: AnyAlert
kind: Scheduled
version: 1.0.2

Stages and Predicates

Stage 1: `source`

Unifi_SiteManager_Devices_CL

Stage 2: `where`

| where TimeGenerated > ago(1d)

Stage 3: `summarize`

| summarize arg_max(TimeGenerated, *) by Id

Stage 4: `where`

| where isnotempty(UpdateAvailable)

Stage 5: `extend`

| extend DeviceDetail = strcat(coalesce(Name, "Unnamed"), " (", Model, ") ", Version, " -> ", UpdateAvailable, " @", Ip)

Stage 6: `summarize`

| summarize
    DevicesNeedingUpdate = count(),
    DeviceList = make_list(DeviceDetail),
    Models = make_set(Model),
    ProductLines = make_set(ProductLine)

Stage 7: `where`

| where DevicesNeedingUpdate >= 1

Stage 8: `extend`

| extend
    TimeGenerated = now(),
    AffectedModels = strcat_array(Models, ", "),
    AffectedProductLines = strcat_array(ProductLines, ", "),
    DeviceListString = strcat_array(DeviceList, "; ")

Stage 9: `extend`

| extend Activity = strcat(DevicesNeedingUpdate, ' device(s) have firmware updates available: ', AffectedModels)

Stage 10: `project`

| project
    TimeGenerated,
    DevicesNeedingUpdate,
    AffectedModels,
    AffectedProductLines,
    Activity,
    DeviceListString

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`DevicesNeedingUpdate`	ge	`1`	`field:"DevicesNeedingUpdate" kind:ge value:"1"`
`UpdateAvailable`	is_not_null	(no value, null check)	`field:"UpdateAvailable" kind:is_not_null`

Output fields

These fields are emitted when the rule matches.

Field	Source
`Activity`	`project`
`AffectedModels`	`project`
`AffectedProductLines`	`project`
`DeviceListString`	`project`
`DevicesNeedingUpdate`	`project`
`TimeGenerated`	`project`

UniFi Site Manager: Firmware Update Available

MITRE ATT&CK coverage

Rule body

Stages and Predicates

Stage 1: source

Stage 2: where

Stage 3: summarize

Stage 4: where

Stage 5: extend

Stage 6: summarize

Stage 7: where

Stage 8: extend

Stage 9: extend

Stage 10: project